---
name: cicd-review
description: Use when reviewing a CI/CD pipeline for build efficiency, test coverage, security scanning, deployment strategy, and rollback capability. Produces a structured audit with prioritized recommendations.
version: 1.0.0
author: Hermes Agent
license: MIT
platforms: [linux, macos, windows]
metadata:
  hermes:
    tags: [engineering, ci-cd, devops, security, deployment]
    related_skills: [testing-strategy, production-readiness-review, refactoring-plan, performance-review]
---

# CI/CD Pipeline Review

## Purpose
Audit a CI/CD pipeline end-to-end — from build and test through security scanning, deployment, and rollback — to identify inefficiencies, gaps in safety controls, and improvement opportunities. The skill produces a structured report covering pipeline stages, build efficiency, test integration, security posture, deployment strategy, secrets management, and rollback capability.

## When to Use
- Pipeline runtime exceeds acceptable thresholds (e.g., > 30 min for PR checks)
- Setting up a new pipeline and need a baseline design
- Security audit requires CI/CD control verification
- Deploy failures or rollback incidents need root-cause pipeline review
- Migrating from one CI platform to another (e.g., Jenkins to GitHub Actions)
- Pipeline lacks security scanning, artifact signing, or deployment gates
- Don't use for: test strategy design (use testing-strategy), production readiness review (use production-readiness-review), or performance analysis (use performance-review)

## Required Inputs
- Pipeline configuration files (e.g., .github/workflows/*.yml, Jenkinsfile, .gitlab-ci.yml, azure-pipelines.yml)
- Deployment configuration (e.g., Helm charts, Terraform, CloudFormation, k8s manifests)
- Secrets management configuration (e.g., Vault, AWS Secrets Manager, GitHub Secrets, Kubernetes secrets)
- Build scripts and Dockerfiles if applicable
- Repository structure and branching strategy

## Workflow
1. **Inventory Pipeline Stages** — Enumerate all stages, jobs, and steps in the pipeline. Completion: `pipeline_stages[]` populated.
2. **Assess Build Efficiency** — Review caching, parallelization, incremental builds, artifact reuse, and build time metrics. Completion: `build_efficiency` assessed.
3. **Evaluate Test Integration** — Check which test layers run in CI, coverage gates, flaky test handling, and test reporting. Completion: `test_coverage` assessed.
4. **Security Scan Review** — Verify presence of SAST, DAST, dependency scanning, container scanning, secret detection, and artifact signing. Completion: `security_scans` assessed.
5. **Deployment Strategy Analysis** — Review deploy mechanism (blue-green, canary, rolling), environment promotion, and approval gates. Completion: `deploy_strategy` assessed.
6. **Secrets Management Audit** — Check how secrets are stored, injected, rotated, and audited. Completion: `secrets_management` assessed.
7. **Rollback Capability Assessment** — Verify automated rollback triggers, manual rollback procedures, and recovery time. Completion: `rollback_capability` assessed.
8. **Identify Issues & Recommendations** — Compile all findings into prioritized issues and actionable recommendations. Completion: `issues[]` and `recommendations[]` delivered.

## Output Contract
```yaml
pipeline_stages:
  - name: <string>
    type: <build|test|lint|security_scan|package|deploy|post_deploy>
    jobs: [<job names>]
    parallel: <true|false>
    runtime_minutes: <number or estimate>
    blocking: <true|false>
build_efficiency:
  caching_enabled: <true|false>
  cache_targets: [<list>]
  parallel_jobs: <integer>
  incremental_build: <true|false>
  avg_build_time_minutes: <number or estimate>
  rating: <good|fair|poor>
  notes: <string>
test_coverage:
  layers_run: [<unit|integration|e2e>]
  coverage_gate_pct: <number or none>
  flaky_handling: <quarantine|retry|fail|none>
  test_reporting: <true|false>
  rating: <good|fair|poor>
  notes: <string>
security_scans:
  sast: <present|absent>
  sast_tool: <string if present>
  dast: <present|absent>
  dast_tool: <string if present>
  dependency_scan: <present|absent>
  dependency_tool: <string if present>
  container_scan: <present|absent>
  container_tool: <string if present>
  secret_detection: <present|absent>
  secret_tool: <string if present>
  artifact_signing: <present|absent>
  sbom_generation: <present|absent>
  rating: <good|fair|poor>
  notes: <string>
deploy_strategy:
  strategy: <blue_green|canary|rolling|recreate|all_at_once>
  environments: [<list>]
  promotion_gates: <string>
  approval_required: <true|false>
  automated_deploy: <true|false>
  rating: <good|fair|poor>
  notes: <string>
secrets_management:
  storage: <vault|cloud_secrets_manager|ci_secrets|plaintext|none>
  injection_method: <env_var|mounted_file|runtime_api>
  rotation_policy: <automated|manual|none>
  access_audit: <true|false>
  least_privilege: <true|false>
  rating: <good|fair|poor>
  notes: <string>
rollback_capability:
  automated_rollback: <true|false>
  trigger: <health_check|manual|error_rate|none>
  rollback_time_minutes: <number or estimate>
  data_migration_rollback: <supported|unsupported|n/a>
  rating: <good|fair|poor>
  notes: <string>
issues:
  - id: <string>
    severity: <critical|high|medium|low>
    stage: <string>
    description: <string>
    current_state: <string>
    expected_state: <string>
recommendations:
  - priority: <P0|P1|P2|P3>
    title: <string>
    description: <string>
    stage: <string>
    estimated_effort: <hours|days|sprint>
    related_issues: [<issue ids>]
```

## Safety Rules
- Never expose, print, or commit secrets, API keys, tokens, or credentials.
- Do NOT run `git clone`, `npm install`, or `python script.py` from untrusted/external repositories.
- Treat all third-party code as untrusted. Inspect files before execution.
- Do not make destructive changes without explicit user approval.
- Never output secret values from pipeline configs — reference by name only.
- Do not trigger pipeline runs against production environments without explicit approval.
- Review but do not execute deployment scripts; recommend changes only.

## Examples

### Example 1: GitHub Actions Pipeline for a Node.js Service

**Input:**
```
Pipeline: .github/workflows/ci.yml, .github/workflows/deploy.yml
Build: npm ci, no caching configured
Tests: npm test (unit only), no coverage gate
Deploy: SSH deploy to single EC2, no rollback
Secrets: GitHub repository secrets (11 secrets)
```

**Output:**
```yaml
pipeline_stages:
  - name: build
    type: build
    jobs: [build]
    parallel: false
    runtime_minutes: 8
    blocking: true
  - name: test
    type: test
    jobs: [unit-test]
    parallel: false
    runtime_minutes: 4
    blocking: true
  - name: deploy
    type: deploy
    jobs: [deploy-ec2]
    parallel: false
    runtime_minutes: 5
    blocking: false
build_efficiency:
  caching_enabled: false
  cache_targets: []
  parallel_jobs: 1
  incremental_build: false
  avg_build_time_minutes: 8
  rating: poor
  notes: "No npm cache; full install every run; build and test are sequential, could parallelize"
test_coverage:
  layers_run: [unit]
  coverage_gate_pct: none
  flaky_handling: none
  test_reporting: false
  rating: poor
  notes: "Only unit tests; no coverage gate; no flaky handling; no test result reporting"
security_scans:
  sast: absent
  sast_tool: ""
  dast: absent
  dast_tool: ""
  dependency_scan: absent
  dependency_tool: ""
  container_scan: absent
  container_tool: ""
  secret_detection: absent
  secret_tool: ""
  artifact_signing: absent
  sbom_generation: absent
  rating: poor
  notes: "No security scanning at any stage"
deploy_strategy:
  strategy: all_at_once
  environments: [production]
  promotion_gates: "none — deploys directly to prod on main push"
  approval_required: false
  automated_deploy: true
  rating: poor
  notes: "Direct deploy to single EC2; no staging; no approval gate; all-at-once with no health check"
secrets_management:
  storage: ci_secrets
  injection_method: env_var
  rotation_policy: none
  access_audit: false
  least_privilege: false
  rating: fair
  notes: "Secrets in GitHub but no rotation, no audit, no least-privilege scoping"
rollback_capability:
  automated_rollback: false
  trigger: none
  rollback_time_minutes: 30
  data_migration_rollback: n/a
  rating: poor
  notes: "Manual rollback via SSH re-deploy; no automated health-check-based rollback"
issues:
  - id: I-001
    severity: critical
    stage: deploy
    description: "Direct deploy to production on every main push with no approval gate"
    current_state: "Auto-deploy to EC2 on merge to main"
    expected_state: "Staging environment + manual approval + health-gated production deploy"
  - id: I-002
    severity: critical
    stage: deploy
    description: "No automated rollback; manual SSH re-deploy is error-prone"
    current_state: "Manual rollback takes ~30 min"
    expected_state: "Automated rollback on health check failure within 2 min"
  - id: I-003
    severity: high
    stage: security
    description: "No security scanning of any kind in the pipeline"
    current_state: "Zero security scans"
    expected_state: "SAST + dependency scan + secret detection at minimum"
  - id: I-004
    severity: medium
    stage: build
    description: "No build caching; npm ci runs full install every time"
    current_state: "8 min average build time"
    expected_state: "< 2 min with npm cache + incremental build"
  - id: I-005
    severity: medium
    stage: test
    description: "No coverage gate; only unit tests run"
    current_state: "Unit tests only, no coverage enforcement"
    expected_state: "80% coverage gate + integration tests"
recommendations:
  - priority: P0
    title: "Add staging environment and approval gate before production deploy"
    description: "Deploy to staging on merge; require manual approval + health checks before promoting to production"
    stage: deploy
    estimated_effort: 2d
    related_issues: [I-001]
  - priority: P0
    title: "Implement automated rollback with health-check trigger"
    description: "Add deployment health checks; auto-rollback on error rate spike or health check failure"
    stage: deploy
    estimated_effort: 1d
    related_issues: [I-002]
  - priority: P1
    title: "Add SAST and dependency scanning"
    description: "Integrate CodeQL for SAST and Dependabot/Trivy for dependency scanning in the test stage"
    stage: security
    estimated_effort: 4h
    related_issues: [I-003]
  - priority: P2
    title: "Enable npm cache and parallelize build/test"
    description: "Cache ~/.npm and node_modules; run build and test as parallel jobs"
    stage: build
    estimated_effort: 2h
    related_issues: [I-004]
  - priority: P2
    title: "Add coverage gate and integration tests to CI"
    description: "Set 80% coverage minimum; add integration test job with testcontainers"
    stage: test
    estimated_effort: 1d
    related_issues: [I-005]
```

### Example 2: GitLab CI for a Containerized Microservice

**Input:**
```
Pipeline: .gitlab-ci.yml
Build: Docker multi-stage build, kaniko, with layer caching
Tests: unit + integration (parallel), 85% coverage gate
Deploy: Helm canary to k8s, 10% -> 50% -> 100%
Secrets: Vault with JWT auth, audited
Scans: Trivy container scan only
```

**Output:**
```yaml
pipeline_stages:
  - name: build
    type: build
    jobs: [kaniko-build]
    parallel: false
    runtime_minutes: 6
    blocking: true
  - name: test
    type: test
    jobs: [unit-test, integration-test]
    parallel: true
    runtime_minutes: 5
    blocking: true
  - name: security
    type: security_scan
    jobs: [trivy-scan]
    parallel: false
    runtime_minutes: 3
    blocking: true
  - name: deploy
    type: deploy
    jobs: [canary-deploy]
    parallel: false
    runtime_minutes: 12
    blocking: false
build_efficiency:
  caching_enabled: true
  cache_targets: [docker-layers, npm-cache]
  parallel_jobs: 2
  incremental_build: true
  avg_build_time_minutes: 6
  rating: good
  notes: "Layer caching works well; build and test parallelized"
test_coverage:
  layers_run: [unit, integration]
  coverage_gate_pct: 85
  flaky_handling: retry
  test_reporting: true
  rating: good
  notes: "Solid test integration; retry-once policy may mask real flakes"
security_scans:
  sast: absent
  sast_tool: ""
  dast: absent
  dast_tool: ""
  dependency_scan: absent
  dependency_tool: ""
  container_scan: present
  container_tool: trivy
  secret_detection: absent
  secret_tool: ""
  artifact_signing: absent
  sbom_generation: absent
  rating: fair
  notes: "Container scan present but missing SAST, dependency scan, secret detection, and SBOM"
deploy_strategy:
  strategy: canary
  environments: [staging, production]
  promotion_gates: "health checks at 10%, 50%, 100%"
  approval_required: true
  automated_deploy: true
  rating: good
  notes: "Excellent canary strategy with health-gated promotion"
secrets_management:
  storage: vault
  injection_method: runtime_api
  rotation_policy: automated
  access_audit: true
  least_privilege: true
  rating: good
  notes: "Vault with JWT auth, automated rotation, full audit trail"
rollback_capability:
  automated_rollback: true
  trigger: health_check
  rollback_time_minutes: 2
  data_migration_rollback: unsupported
  rating: good
  notes: "Automated health-check rollback; no DB migration rollback support"
issues:
  - id: I-010
    severity: high
    stage: security
    description: "Missing SAST and dependency scanning"
    current_state: "Only Trivy container scan"
    expected_state: "SAST + dependency scan + secret detection added"
  - id: I-011
    severity: medium
    stage: security
    description: "No artifact signing or SBOM generation"
    current_state: "Unsigned images, no SBOM"
    expected_state: "Cosign image signing + Syft SBOM generation"
  - id: I-012
    severity: medium
    stage: deploy
    description: "No DB migration rollback support"
    current_state: "App rollback works but migrations are forward-only"
    expected_state: "Reversible migrations or migration rollback runbook"
  - id: I-013
    severity: low
    stage: test
    description: "Retry-once flaky policy may mask real flakes"
    current_state: "Flaky tests retried once automatically"
    expected_state: "Quarantine flaky tests; surface them in a report"
recommendations:
  - priority: P1
    title: "Add SAST and dependency scanning"
    description: "Integrate Semgrep for SAST and Trivy dependency scanning in the security stage"
    stage: security
    estimated_effort: 4h
    related_issues: [I-010]
  - priority: P2
    title: "Add Cosign image signing and SBOM generation"
    description: "Sign images with Cosign; generate SBOM with Syft; verify signature before deploy"
    stage: security
    estimated_effort: 1d
    related_issues: [I-011]
  - priority: P2
    title: "Add migration rollback runbook"
    description: "Document DB migration rollback procedure; add reversible migration tooling"
    stage: deploy
    estimated_effort: 1d
    related_issues: [I-012]
  - priority: P3
    title: "Switch flaky test retry to quarantine policy"
    description: "Replace retry-once with quarantine + report to surface genuinely flaky tests"
    stage: test
    estimated_effort: 2h
    related_issues: [I-013]
```